From b2effc84d7e6dd1c7c3ae27612159e535d635875 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 19 Oct 2026 13:34:20 +0200 Subject: [PATCH] Record clean provider fleet adoption and owner brief renderer --- .custodian-brief.md | 31 +++--- SCOPE.md | 2 +- docs/staged-work-record-generation.md | 10 +- ...UST-WP-0079-deterministic-security-flow.md | 95 ++++++++++++++++++- 4 files changed, 115 insertions(+), 23 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index ef8b60a..342ef3a 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,25 +2,29 @@ # Custodian Brief — the-custodian **Domain:** infotech -**Last synced:** 2026-10-13 20:02 UTC +**Last synced:** 2026-10-19 10:44 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### NetKingdom security blueprint and SEC-DSM gap closure -Progress: 2/5 done | workplan_id: `dfadb19b-445e-59c6-bcd6-48e87b912c52` +### Deterministic security flow: standing authorizations, flow report, and agent re-engagement +Progress: 3/7 done | workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3` **Open tasks:** -- ► Close source defects and reconcile uncovered lifecycle gaps `87637402` -- ► Coordinate self-service Playwright identity delivery `ed8b909a` -- · Verify native closure against every requirement `82378b0f` +- ! Schedule the flow report and decision sync `1be0569c` + *(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)* +- ! Encode the standing change rule as a policy-nexus guardrail `5dd52156` + *(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)* +- ! Attended window #1 `e3da807f` + *(wait: Owner source rechecked 2026-10-19: RPF-WP-0044-T08 is done and KEY-WP-0040-T01 preview is done. Remaining attended acts are USER-WP-0026-T03 positive readback, USER-WP-0028-T03 U08 recovery, and RPF-WP-0044-T04 OpenBao OIDC/MFA login; completed preview does not authorize factor mutation.)* +- ► Stop agent-authored index and sync commits `8a3dc219` ### Separate agent credentials and establish supervised privileged execution Progress: 2/5 done | workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d` **Open tasks:** - ! Build and hand out the agent identity `4b88b0b7` - *(wait: Await GLAS-WP-0012 (glas-harness) production acceptance of the local supervised profile; then railiance-platform RBAC, railiance-enablement k3s config, railiance-infra principal mapping and ops-warden certificate issuance.)* + *(wait: Await GLAS-WP-0012 (glas-harness) production acceptance of the local supervised profile; then railiance-platform RBAC, railiance-cluster persistent k3s config, railiance-infra principal/account mapping and ops-warden certificate issuance.)* - ! Fleet guidance and harness guards `90725511` *(wait: Await CUST-WP-0073-T02: the verified agent identity and execution path must exist before it can be documented; Codex/Grok read-denial guard needs glas-harness or harness-owner delivery.)* - ! Rotate what was exposed `1b41b532` @@ -39,19 +43,6 @@ Progress: 1/5 done | workplan_id: `2249bddb-7524-5add-bd5c-c4163a6ca0f3` - ! Establish the regular weekly workload-demand and allocation assessment `20ddd4d7` *(wait: Await the repeatable observation and accepted sizing/review procedure.)* -### Deterministic security flow: standing authorizations, flow report, and agent re-engagement -Progress: 3/7 done | workplan_id: `ab288f92-d364-5c24-9362-aee451f266c3` - -**Open tasks:** -- ! Schedule the flow report and decision sync `1be0569c` - *(wait: Activity Core accepted the schedule in ACTIVITY-WP-0047. Await claiming rein workstation/hub acceptance, owner activation and the first unassisted fire with report/checkpoint evidence.)* -- ! Encode the standing change rule as a policy-nexus guardrail `5dd52156` - *(wait: policy-nexus owns guardrail publication; handoff written as PNEX-WP-0006.)* -- ! Stop agent-authored index and sync commits `8a3dc219` - *(wait: Local guard and repeatable shared-hook installation are implemented. Fleet generator adoption and the required full week of clean history remain unverified; repo-manager owner acceptance is needed.)* -- ! Attended window #1 `e3da807f` - *(wait: Partly done 2026-10-11: list cut from 14 to 3; U05-U07 accepted, U08 waits on KEY-WP-0040-T01. Remaining founder acts: USER-WP-0026-T03 readback, RPF-WP-0044-T08 coulombcore check, the U08 re-run, and Sol's added RPF-WP-0044-T04 issuer login.)* - --- ## MCP Orientation (when available) diff --git a/SCOPE.md b/SCOPE.md index 2389275..398a057 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -218,7 +218,7 @@ keywords: [git, generated, hooks, work-records, validation] ```capability type: tool title: Staged work-record index generation -description: make generated-work-records reuses the State Hub renderer on staged Markdown, with explicit repository identity, and stages only WORK-RECORDS.md while refusing unstaged generated-file edits. make generated-work-records-check is read-only. Source adapter and tests are implemented; the shared/local hook supports explicit per-repo adoption, with activity-core, policy-nexus and repo-manager committed. Remaining fleet and other index adoption are still open. See docs/staged-work-record-generation.md. +description: make generated-work-records reuses the State Hub renderer on staged Markdown, with explicit repository identity, and stages only WORK-RECORDS.md while refusing unstaged generated-file edits. make generated-work-records-check is read-only. Source adapter and tests are implemented; the shared/local hook supports explicit per-repo adoption, with provider adoption and exact commit receipts tracked in CUST-WP-0079. Other artifact families still need owner automation. See docs/staged-work-record-generation.md. keywords: [git, generated, work-records, staged-sources, validation] ``` diff --git a/docs/staged-work-record-generation.md b/docs/staged-work-record-generation.md index fccd72b..6321cbb 100644 --- a/docs/staged-work-record-generation.md +++ b/docs/staged-work-record-generation.md @@ -62,4 +62,12 @@ python3 scripts/install_shared_generated_guard.py --repo . --install --enable-ge Unknown hook compositions are refused; existing other hooks and routing remain unchanged. The option does not opt any repository into generation on its own. Source inventories and publication indexes retain their respective owner generators; this adapter generates only the -work-record index. Fleet adoption remains an open CUST-WP-0079-T05 obligation. +work-record index. Provider adoption receipts are recorded in CUST-WP-0079-T05; other artifact families remain open. + + +The State Hub owner also exposes `scripts/generate_custodian_brief.py` and +`make brief-generate` / `brief-check` with explicit repository path and slug. +This separate command reads the current hub projection, performs no Git operations, +and preserves the existing brief on unavailable or malformed endpoint reads. It +is not part of the staged Markdown hook: it cannot represent unprojected source. +Keep historical timestamps when a fresh render fails; do not claim a fresh snapshot. diff --git a/workplans/CUST-WP-0079-deterministic-security-flow.md b/workplans/CUST-WP-0079-deterministic-security-flow.md index 52700cd..3280ad6 100644 --- a/workplans/CUST-WP-0079-deterministic-security-flow.md +++ b/workplans/CUST-WP-0079-deterministic-security-flow.md @@ -114,7 +114,7 @@ Canon source written 2026-10-11: `canon/standards/build-mode-change-authorizatio ```task id: CUST-WP-0079-T05 status: progress -blocking_reason: "Staged WORK-RECORDS generation adopted in activity-core, policy-nexus and repo-manager with Custodian activation underway. Remaining security fleet adoption and other owner index generators are still open; the 498-commit local seven-day history check passed." +blocking_reason: "Staged WORK-RECORDS generation is adopted across the default security estate and relevant providers. Other artifact families and recurring brief/source-inventory/coordination-frame automation remain open; the 498-commit local seven-day history check passed." priority: medium state_hub_task_id: "8a3dc219-8982-5903-9407-e1b549d4544c" ``` @@ -292,3 +292,96 @@ coordination-frame receiver through `tools/coordination-frame/render.py`. Historic evidence inventories are not recurring generator outputs. T05 stays open until those applicable owner generation paths and fleet acceptance are verified; the independent schedule, publication and attended gates remain open. + + +### Fleet WORK-RECORDS adoption and source cleanup — 2026-10-19 + +The staged WORK-RECORDS lane is now adopted across every repository in the +15-repository default security report estate, plus the relevant implementation +providers. Each adopted repository declares its canonical slug, isolated Make +recipe and SCOPE boundary. Real commit hooks checked/rendered the staged index; +shared generated-only rejection and existing exact-scope secret scans remained +in force. No native runtime, credentials, public policy or schedule activation +was performed by this adoption. + +Current provider source revisions at clean-checkout verification: + +| Repository | Commit | +| --- | --- | +| net-kingdom | `4c7f32a` | +| railiance-platform | `b06d1f0` | +| access-engine | `7eb4e22` | +| secrets-engine | `510d292` | +| ops-mason | `3457ecf` | +| key-cape | `5defa33` | +| user-engine | `db05c13` | +| tenant-engine | `f94bb5d` | +| gate-house | `c7d47f8` | +| kings-guard | `5e4942f` | +| rapp-policy-nexus | `ff41754` | +| activity-core | `7490eb8` | +| policy-nexus | `c89364d` | +| repo-manager | `05046fb` | +| ops-warden | `6ed0e9e` | +| railiance-cluster | `4604faf` | +| railiance-forge | `9aa2ac6` | +| railiance-apps | `a6fe0ab` | +| resource-framework (`resource-control`) | `0754009` | +| rapp-telemetry | `6015b54` | +| railiance-telemetry | `d089325` | +| vergabe-watch (`vergabe-teilnahme`) | `17429f8` | +| railiance-infra | `5094c30` | +| glas-harness | `579cefd` | +| rein-codex (`rein-aharness`) | `fb14c38` | + +The first fifteen provider rows were rechecked directly after the final commit; +the additional sizing/isolation rows carry their worker completion receipts and +root's independent checkout verification. Custodian's own source adoption was +committed separately and uses its reviewed local scanner-hook composition. + +Dirty generated indexes were inspected and original snapshots retained under +`/tmp/cust79-fleet-adoption//`. Platform, Access and King's Guard originals +matched the staged owner renderer exactly. NetKingdom and Secrets originals +were stale row subsets of current source; regeneration added the missing source +records. User Engine's original reflected its pending source handoff, which was +reviewed and committed with the derived index rather than discarded. + +Existing unfinished source was inspected and retained: Ops Mason's lock matched +its current pyproject (`uv lock --check --offline`) and all 260 tests passed; +its lock is now committed. Rapp Policy Nexus passed its nine packaging tests and +Helm lint. USER-WP-0035-T02's pending owner handoff was checked against current +caller/receiver/provider/portal code and retained with dated source hashes. +EMAIL-IN-0001 is durable in email-connect `994db7d` (clean), and NET-IN-0005 is +included in `4c7f32a`. Both remain owner preparation requests; they do not prove +setup-mail capability or runtime delivery. NetKingdom's pending cadence capture +receipts were preserved (3 events, 3 receipts, 588 inventory observations); their +record still says independent receiver readback is pending. No current process +or cadence acceptance is inferred from those historical files. + +User Engine's typo-suffixed `.claude/settings.local.json.` was inspected and +preserved inactive at +`/home/worsch/.local/state/custodian-preserved/user-engine/settings.local.json.inactive-2026-10-19`, +SHA256 `b70496e3978a7e45304ad6e2042f81953bc8d6ac518aa82fcab36c4e5c754243`. +It was not renamed to active settings or used to grant permissions; the location +and hash receipt is committed with the source reconciliation. + +State Hub supplied a separate strict rendering-only brief CLI in `09803dc`, +with identifier follow-up `f8f9cd9` verified in publication/projection and +published capability declaration `eac38b7`. Owner +validation passed 17 focused tests and 168 consistency tests on rerun; initial +combined-suite database teardown errors are retained in the owner/root report. +The CLI does not perform Git operations or Hub writes. Attempts to refresh the +five pending security briefs failed closed at `/repo-goals` or `/repos/`; +no replacement snapshot was written. Their existing generated deltas were +reviewed against source, retained with their original October 15–18 timestamps, +and committed alongside meaningful adoption source. They are historical +orientation, not fresh Hub readback. Originals remain in the preservation +snapshot. The brief's deliberate Markdown hard-break whitespace was retained. + +T05 remains progress: WORK-RECORDS adoption does not establish automation for +hub-derived briefs, Policy Nexus source inventory, or NetKingdom's generated +coordination-frame receiver. Those owner generator families and recurring +execution remain to be implemented/verified without changing authored source +inventory dispositions. T03, T04 and T06 retain their independent schedule, +publication and attended acceptance gates. No new owner acceptance is inferred +from clean checkouts or the earlier clean seven-day Git window.